batman-adv/patches/0004-batman-adv-Check-for-alloc-errors-when-preparing-TT-.patch

   1 From: Sven Eckelmann <sven@narfation.org>
   2 Date: Wed, 30 Nov 2016 21:47:09 +0100
   3 Subject: [PATCH] batman-adv: Check for alloc errors when preparing TT local data
   4
   5 batadv_tt_prepare_tvlv_local_data can fail to allocate the memory for the
   6 new TVLV block. The caller is informed about this problem with the returned
   7 length of 0. Not checking this value results in an invalid memory access
   8 when either tt_data or tt_change is accessed.
   9
  10 Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
  11 Fixes: 21a57f6e7a3b ("batman-adv: make the TT CRC logic VLAN specific")
  12 Signed-off-by: Sven Eckelmann <sven@narfation.org>
  13 Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
  14 ---
  15  net/batman-adv/translation-table.c | 4 ++--
  16  1 file changed, 2 insertions(+), 2 deletions(-)
  17
  18 diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
  19 index 7f66309..0dc85eb 100644
  20 --- a/net/batman-adv/translation-table.c
  21 +++ b/net/batman-adv/translation-table.c
  22 @@ -3282,7 +3282,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
  23                                                              &tvlv_tt_data,
  24                                                              &tt_change,
  25                                                              &tt_len);
  26 -               if (!tt_len)
  27 +               if (!tt_len || !tvlv_len)
  28                         goto unlock;
  29
  30                 /* Copy the last orig_node's OGM buffer */
  31 @@ -3300,7 +3300,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
  32                                                              &tvlv_tt_data,
  33                                                              &tt_change,
  34                                                              &tt_len);
  35 -               if (!tt_len)
  36 +               if (!tt_len || !tvlv_len)
  37                         goto out;
  38
  39                 /* fill the rest of the tvlv with the real TT entries */